registry / @runfusion/fusion / 0.54.0

@runfusion/fusion@0.54.0

Fusion CLI: HTTP API server, daemon, dashboard launcher, and task tooling for the Fusion AI coding agent.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 373 file(s), 22.0 MB of source, external domains: 127.0.0.1, api.example.com, api.github.com, bit.ly, chevrotain.io, discord.gg, docs.expo.dev, docs.openclaw.ai, en.wikipedia.org, feross.org, github.com, hooks.example.com, jquery.org, json-schema.org, langium.org, lodash.com, node.example.com, ntfy.sh, openjsf.org, paperclip.ing, pro.reactflow.dev, react.dev, reactflow.dev, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, runfusion.ai, searx.example.com, sheetjs.com, skills.sh, tldrlegal.com, underscorejs.org, www.w3.org, your-domain.example

Oversized source lightweight scan

dist/bin.js12.9 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsShellDynamicRequireHighEntropyStringsUrlStringsfeross.orggithub.comregistry.npmjs.orgsheetjs.comskills.sh

dist/client/assets/index-BjELA24x.js2.22 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStrings127.0.0.1github.comrunfusion.aiwww.w3.org

dist/desktop/client/assets/index-lGrAUOVY.js2.22 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStrings127.0.0.1github.comrunfusion.aiwww.w3.org

dist/extension.js9.21 MB file, sampled 256 KB

NetworkEnvironmentVarsDynamicRequireHighEntropyStrings

dist/plugins/fusion-plugin-droid-runtime/bundled.js5.03 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsShellDynamicRequireHighEntropyStringsUrlStringsdocs.expo.dev

Source & flagged code

5 flagged

dist/chunk-AWKNRUOR.jsView file

Lines 643-683javascript

643

644Output Requirements:

645- Fast-bail: if Diff Scope contains no QA-relevant files, output {"verdict":"APPROVE","notes":"out of scope: QA"} immediately.

646- APPROVE: lint/tests/typecheck pass and no actionable bugs.

647- APPROVE_WITH_NOTES: quality gates pass but include non-blocking advisories in notes.

648- REVISE: any gate fails or actionable bugs are found; include failing commands and affected file paths in notes.

649- Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):

650{"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"..."}`

651 },

652 {

653 id: "security-audit",

654 name: "Security Audit",

655 description: "Check for common security vulnerabilities and anti-patterns",

656 category: "Security",

657 icon: "shield",

658 toolMode: "readonly",

659 prompt: `You are a security auditor. Review the task changes for common security vulnerabilities.

660

661Security Checklist:

6621. **Injection vulnerabilities** \u2014 Check for SQL injection, command injection, XSS via unsanitized user input

6632. **Secrets and credentials** \u2014 Ensure no hardcoded passwords, API keys, tokens, or private keys

6643. **Unsafe eval** \u2014 Check for eval(), new Function(), or similar dangerous patterns

6654. **Path traversal** \u2014 Verify file path handling prevents directory traversal attacks

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-AWKNRUOR.jsView on unpkg · L663

6665. **Insecure deserialization** \u2014 Check for unsafe parsing of untrusted data

6676. **Authentication/Authorization** \u2014 Verify access controls are properly implemented

6687. **Dependency risks** \u2014 Note any new dependencies that might have known vulnerabilities

669

670Files to Review:

671- All modified files in the task

672- Configuration files that might contain secrets

673- Areas handling user input or external data

674

675Output Requirements:

676- Fast-bail: if Diff Scope contains no security-relevant files, output {"verdict":"APPROVE","notes":"out of scope: security"} immediately.

677- APPROVE: no security issues found.

678- APPROVE_WITH_NOTES: no blocking issues, but include advisory hardening opportunities in notes.

679- REVISE: vulnerabilities require changes; include file paths, severity, and remediation guidance in notes.

680- Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):

681{"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"..."}`

682 },

683 {

bin.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { constants } from "node:fs";

4import { access } from "node:fs/promises";

5import { dirname, resolve } from "node:path";

6import { fileURLToPath, pathToFileURL } from "node:url";

8const

dist/chunk-PSDYB45U.jsView file

Lines 8-48javascript

8import { join as join2 } from "path";

10// ../core/dist/memory-backend.js

11import { readFile, writeFile, mkdir, access, constants, readdir, stat } from "fs/promises";

12import { existsSync } from "fs";

13import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";

dist/bin.jsView file

•path = dist/bin.js kind = oversized_source_file sizeBytes = 13564151 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.jsView on unpkg

•path = dist/bin.js kind = oversized_cli_entrypoint sizeBytes = 13564151 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/chunk-AWKNRUOR.jsView file

6632. **Secrets and credentials** \u2014 Ensure no hardcoded passwords, API keys, tokens, or private keys L664: 3. **Unsafe eval** \u2014 Check for eval(), new Function(), or similar dangerous patterns L665: 4. **Path traversal** \u2014 Verify file path handling prevents directory traversal attacks

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-AWKNRUOR.jsView on unpkg · L663

bin.mjsView file

19L20: await import(pathToFileURL(distEntry).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.mjsView on unpkg · L19

dist/chunk-PSDYB45U.jsView file

28function shouldSkipBackgroundQmdRefresh() { L29: return (process.env.VITEST === "true" || process.env.NODE_ENV === "test") && process.env.FUSION_ENABLE_QMD_REFRESH_IN_TESTS !== "1"; L30: } ... L168: async write(rootDir, content) { L169: const result = await this.fileBackend.write(rootDir, content); L170: scheduleQmdProjectMemoryRefresh(rootDir); ... L453: try { L454: const { execFile } = await import("child_process"); L455: const { promisify } = await import("util"); ... L459: const args = buildQmdSearchArgs(rootDir, options); L460: const { stdout } = await execFileAsync(command, args, { L461: cwd: rootDir,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-PSDYB45U.jsView on unpkg · L28

dist/bin.jsView file

•path = dist/bin.js kind = oversized_source_file sizeBytes = 13564151 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.jsView on unpkg

•path = dist/bin.js kind = oversized_cli_entrypoint sizeBytes = 13564151 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.jsView on unpkg

Findings

2 High6 Medium7 Low

HighObfuscated

HighOversized Source Filedist/bin.js

MediumDynamic Requirebin.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointdist/bin.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-AWKNRUOR.js

LowWeak Cryptodist/chunk-PSDYB45U.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/chunk-AWKNRUOR.jsView file

Lines 643-683javascript

643

644Output Requirements:

645- Fast-bail: if Diff Scope contains no QA-relevant files, output {"verdict":"APPROVE","notes":"out of scope: QA"} immediately.

646- APPROVE: lint/tests/typecheck pass and no actionable bugs.

647- APPROVE_WITH_NOTES: quality gates pass but include non-blocking advisories in notes.

648- REVISE: any gate fails or actionable bugs are found; include failing commands and affected file paths in notes.

649- Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):

650{"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"..."}`

651 },

652 {

653 id: "security-audit",

654 name: "Security Audit",

655 description: "Check for common security vulnerabilities and anti-patterns",

656 category: "Security",

657 icon: "shield",

658 toolMode: "readonly",

659 prompt: `You are a security auditor. Review the task changes for common security vulnerabilities.

660

661Security Checklist:

6621. **Injection vulnerabilities** \u2014 Check for SQL injection, command injection, XSS via unsanitized user input

6632. **Secrets and credentials** \u2014 Ensure no hardcoded passwords, API keys, tokens, or private keys

6643. **Unsafe eval** \u2014 Check for eval(), new Function(), or similar dangerous patterns

6654. **Path traversal** \u2014 Verify file path handling prevents directory traversal attacks

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-AWKNRUOR.jsView on unpkg · L663

6665. **Insecure deserialization** \u2014 Check for unsafe parsing of untrusted data

6676. **Authentication/Authorization** \u2014 Verify access controls are properly implemented

6687. **Dependency risks** \u2014 Note any new dependencies that might have known vulnerabilities

669

670Files to Review:

671- All modified files in the task

672- Configuration files that might contain secrets

673- Areas handling user input or external data

674

675Output Requirements:

676- Fast-bail: if Diff Scope contains no security-relevant files, output {"verdict":"APPROVE","notes":"out of scope: security"} immediately.

677- APPROVE: no security issues found.

678- APPROVE_WITH_NOTES: no blocking issues, but include advisory hardening opportunities in notes.

679- REVISE: vulnerabilities require changes; include file paths, severity, and remediation guidance in notes.

680- Final output: output exactly one trailing JSON object on the final line (no markdown fences, no surrounding prose):

681{"verdict":"APPROVE|APPROVE_WITH_NOTES|REVISE","notes":"..."}`

682 },

683 {

bin.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { constants } from "node:fs";

4import { access } from "node:fs/promises";

5import { dirname, resolve } from "node:path";

6import { fileURLToPath, pathToFileURL } from "node:url";

8const

dist/chunk-PSDYB45U.jsView file

Lines 8-48javascript

8import { join as join2 } from "path";

10// ../core/dist/memory-backend.js

11import { readFile, writeFile, mkdir, access, constants, readdir, stat } from "fs/promises";

12import { existsSync } from "fs";

13import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";

dist/bin.jsView file

•path = dist/bin.js kind = oversized_source_file sizeBytes = 13564151 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.jsView on unpkg

•path = dist/bin.js kind = oversized_cli_entrypoint sizeBytes = 13564151 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.jsView on unpkg